Under the federal attestation materials, no. M-22-18 and the CISA form say agencies should ensure a POA&M or a third party assessment is not posted publicly, by the vendor or by the agency. A signed attestation itself is different, because producers could post it and link it.
What the documents say
M-22-18 covers the case where a producer cannot attest to some practice. The agency requires the producer to identify the practices it cannot attest to, document mitigations and build a Plan of Action and Milestones. The memo then says the agency "shall take appropriate steps to ensure that such documentation is not posted publicly, either by the vendor or by the agency itself."
The CISA form repeats the point for assessments. If a producer relies on a third party assessment, the instructions say the agency "shall take appropriate steps to ensure that the assessment is not posted publicly, either by the vendor or by the agency itself."
Three kinds of document, three different rules
| Document | Public posting under the memo and form | Note |
|---|---|---|
| Signed self-attestation | Allowed | M-22-18 says agencies retain it unless the producer posts it publicly and links to it in the proposal response |
| POA&M and mitigation documentation | Not to be posted | Contains your known gaps and timelines |
| 3PAO assessment attached to the form | Not to be posted | Assessment details are sensitive |
An SBOM follows the same pattern as the attestation. M-22-18 says the agency retains an SBOM it requires, unless the producer posts it publicly and gives the agency a link.
Why the line makes sense
A POA&M is a list of practices you do not yet meet and the dates you plan to fix them. A public copy would be a roadmap for anyone probing your weak points. An assessment report describes how controls were tested. Neither belongs on a marketing page, and a trust center is a marketing page that people tend to forget about.
How to share evidence without posting it
- Keep a public summary of your practices at a high level, such as that you operate a vulnerability disclosure program and publish a security contact.
- Hold detailed reports behind a request process with an NDA. A decision guide on this is in NDA gated vs public trust center documents.
- Mark each document with its sharing rule so sales staff do not paste it into a questionnaire answer by accident.
- Log who received what, and when.
A note on current status
M-26-05 rescinded M-22-18 and M-23-16 in January 2026. The memo does not repeat the no public posting instruction. If you hold a POA&M or an assessment from that period, keep treating it as confidential unless the agency tells you otherwise in writing. Your counsel can confirm what your contract says.
Quick check
Can we say on our website that we have a signed attestation?
You can if it is true and current. Use the exact scope you signed for, and avoid implying a certification, because the attestation is a statement by the producer.
Does the rule apply to assessments from other frameworks?
The sentence in the form is about the 3PAO assessment attached to this form. For other reports, follow the terms in the report and your contract.
Sources
Last reviewed: 19 October 2026.
